This invention relates to a control system which has a self-diagnostic function in which a sub-control circuit backs up a main control circuit when the main control circuit fails.
The rapid progress of electronic technology has been accompanied by the employment of electronic control systems in many types of devices. For security purposes electronic control systems must be highly reliable and, therefore, employ sub-control circuits which operate as a queued redundant system. The sub-control circuit is designed so that it operates as a backup control system when a main control circuit fails. FIG. 1 illustrates an example of a control circuit and a sub-control circuit using microcomputers.
In FIG. 1, a main microcomputer 1 receives data and outputs a control signal A.sub.1 through an output port O.sub.a1 based on the data received. The control signal A.sub.1 operates a driving transistor 2a which excites a coil 4 through a normally closed contact 3a of relay 3. The coil 4 can be used to drive or control controllable elements. The main microcomputer 1 samples a potential through an input port P.sub.a1 at a point between transistor 2a and contact 3a, and uses the potential as a diagnostic signal B.sub.1. When the logical relationship between the control signal A.sub.1 and the diagnostic signal B.sub.1 does not satisfy a predetermined condition, the main microcomputer 1 detects that the transistor 2a or coil 4 is abnormal and outputs a failure signal C.sub.1 through an output port O.sub.a2. The failure signal C.sub.1 activates relay 3 to switch the contacts 3a and 3b, thus connecting the coil 4 to a transistor 2b of a sub-control system. When a sub-microcomputer 5 receives the failure signal C.sub.1 through input port P.sub.b2, the sub-microcomputer 5, which is in a standby state and receives the same input data as that applied to the main microcomputer 1, starts to control the excitation operation. The sub-microcomputer 5, based on the input data, outputs a control signal A.sub.2 through output port O.sub.b1 to control the transistor 2b. The transistor 2b controls the coil 4 through the contact 3b. Thus, the sub-control system, including the sub-microcomputer 5 and the transistor 2b, backs up the main control system, including the main microcomputer 1 and transistor 2a.
When the transistor 2b of the sub-control system fails, the sub-microcomputer 5, using the diagnostic signal B.sub.2 input through input port P.sub.b1, detects the non-coincidence of the control signal A.sub.2 and the diagnostic signal B.sub.2. When the non-coincidence is detected the sub-microcomputer 5 outputs a failure signal C.sub.2 through output port O.sub.b2. When the failure signal C.sub.2 is produced an alarm device 6 is activated and informs an operator that both the sub-control system and the main control system are out of order.
Self-diagnosis takes place in the subcontrol system only after trouble occurs in the main control system. Therefore, the above-described self diagnostic method is only effective when the main control system fails and the sub-control system is activated as a backup. Thus, when the transistor 2b fails before the backup operation is initiated the sub-control circuit is out of order before the backup operation is required. In this situation the failure signal C.sub.2 is produced immediately, the alarm device 6 is activated and the sub-control system provides no backup function for the main control system. The above-described queued redundant system operates on the premise that the sub-control system functions normally at all times. The above-described sub-control system cannot be employed for electronic devices on vehicles which must be very high in reliability.